From 6211810e6ea4670062f2acdf5ef9004fd1f1e4bd Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 2 Sep 2026 12:34:22 +0000 Subject: [PATCH] go: bump toolchain to 1.26.8 and grpc to v1.82.2 to fix govulncheck The daily govulncheck job failed with 5 called vulnerabilities. Four are in the standard library at go1.26.5, all fixed in go1.26.6: GO-2026-6218 (quadratic resolvePath in net/url), GO-2026-6090 (post-handshake message limit in crypto/tls), GO-2026-5972 (asn1 recursion depth), and GO-2026-5026 (idna Punycode labels via net/http). Bump the go directive to 1.26.8, the latest patch on the 1.26 line. The fifth, GO-2026-6061 (xDS RBAC and HTTP/2 server transport), affects google.golang.org/grpc v1.82.0 and is fixed in v1.82.1; upgrade the indirect dependency to v1.82.2. govulncheck now reports no called vulnerabilities; go test ./... and golangci-lint run are clean. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_019LVVYgtuJvuPaaXVrkHkgb --- go.work | 2 +- site/go.mod | 4 ++-- site/go.sum | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/go.work b/go.work index ee601aa3..de0a0d46 100644 --- a/go.work +++ b/go.work @@ -1,3 +1,3 @@ -go 1.26.5 +go 1.26.8 use ./site diff --git a/site/go.mod b/site/go.mod index db30f357..67e9301e 100644 --- a/site/go.mod +++ b/site/go.mod @@ -1,6 +1,6 @@ module github.com/deepakjois/debugjois.dev/site -go 1.26.5 +go 1.26.8 require ( github.com/alecthomas/kong v1.16.0 @@ -62,7 +62,7 @@ require ( golang.org/x/sys v0.47.0 // indirect golang.org/x/text v0.40.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 // indirect - google.golang.org/grpc v1.82.0 // indirect + google.golang.org/grpc v1.82.2 // indirect google.golang.org/protobuf v1.36.11 // indirect mvdan.cc/sh/v3 v3.12.0 // indirect ) diff --git a/site/go.sum b/site/go.sum index ee963008..41fc421a 100644 --- a/site/go.sum +++ b/site/go.sum @@ -147,8 +147,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1: google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA= google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 h1:qEHAMpSaUhtD0p3NbEEI83HwNGFxEwaSJ1G9PLnCBZE= google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU= -google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= +google.golang.org/grpc v1.82.2 h1:2+rCCTC8esfgjDFhN+rIok0FVsBLw/y5vHzNX2FjRLw= +google.golang.org/grpc v1.82.2/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=